InfoSecBulletin Cybersecurity for mankind
CERT Polska has alerted that bad actors are actively exploiting a security flaw in Zimbra Collaboration Suite to execute code remotely. The bug known as CVE-2026-73570 lets attackers who are not logged in run any commands on affected servers as the zimbra user.
There is a flaw with Zimbra’s SNMP monitoring feature. It has a flaw that allows OS command injection. This affects setups that have the zimbra-snmp package on, SNMP notifications turned on with the snmp_notify setting, and the swatchdog service active.
Jailbroken DeepSeek AI Agent Conducts Two-Week Cyberattack on European Telecom
Daily Cyber security update for 10.11. 2026
IBM fixes 208 API Connect vulnerabilities, 47 critical
89 New ransomware groups emerge in 2026, claiming over 2,200 victims
Daily Cyber security update for 08.11. 2026
Japan banking crisis
Outage causes disruption at 128 japan banks: preventing ATM transaction
Daily Cyber security update for 06.11. 2026
Cyber attack causes French bank Credit Mutuel Arkea €100 million missing
OpenAI AI Pipeline Discovers 948 Linux Kernel Privilege Escalation Flaws in 30 Hours
Bangladeshi Researcher Rasel Earns First Apple CVE Recognition for Model I/O Flaw
Swatchdog is enabled by default, increasing the exposure risk for organizations that have enabled SNMP trap notifications.
Zimbra RCE Vulnerability Exploited
An attacker can send special SMTP requests to take advantage of improper sanitization during SNMP notifications. They do not need to log in first, and this can lead to running any shell command with the rights of the Zimbra account.
This access could let attackers set up web shells, steal email data, change server settings, stay hidden, or use the hacked mail server to attack more.
Zimbra fixed CVE-2026-73570 in version 10.1.20, which came out on July 20, 2026. The security notice from the vendor says that the update solves a command injection issue in the SNMP monitoring part when notifications are turned on.
Organizations using older versions should see this issue as a top priority for fixing because attacks have already been seen in real situations. CERT Polska has also shared advice on how to detect if a system has been compromised.
Administrators need to check /var/log/zimbra.log for strange service-status messages. These messages could show an unknown or bad payload that goes from stopped to running, or from running to stopped.
Such activity may show that a hacker has misused the weak notification system to start or stop processes they control. Security teams need to check files made by the Zimbra user in the last 30 days. The key folders to look at are /opt/zimbra/jetty/webapps/, /opt/zimbra/jetty_base/webapps/, and /tmp/.
Unexpected JSP files, running scripts, zipped files, or recently changed application content in these places may show payload staging or staying power.
Organizations need to quickly find all Zimbra Collaboration Suite servers. They must check if SNMP notifications are on and upgrade any weak systems to version 10.1.20 or a newer fixed version.
Administrators should disable unnecessary SNMP notifications and watch SMTP activity, Zimbra logs, process creation, and file changes involving the zimbra account if emergency patching can’t be done right away.
Any signs of misuse should be seen as a possible problem with the mail server. Admins should keep logs, isolate affected computers if needed, change passwords, check mailbox access, and carry out a complete investigation into the incident.
